Why Ransomware Attack Actors
Should be Identified

Hayato Sasaki
Manager of the Early Warning Group, Director of Policy, andThreat Analyst
JPCERT Coordination Center

Various detail levels of public attribution
There are various detail levels of public attribution— Soft attribution: classification of attack groups by security analysts— Hard attribution: identification of attackers and entities behind by government agencies, etc.

Organizations/governments
behind are identified

Sandworm• Speculated/identified
as Russian APT group• Announced criminal
prosecution of GRU
personnel in Oct. 20201© 2023 JPCERT/CCLazarus• Speculated/identified
as North Korean APTgroup• Announced criminal
prosecution of involved
actors in Sep. 2018
and Feb. 2021

Attackers are identified

APT1• Speculated/identified
as Chinese APT group• Mandiant identified theactor in Jan. 2013
• U.S. DOJ announced
criminal prosecution inMay. 2014

Attack groups (and involvedcountry/region) are identified

Kimsuky• Speculated to be North
Korean APT group• Primary target is South
Korea• No actor or organization
behind have been identified
so far

SideCopy• Speculated to be PakistaniAPT group• Targets are organizationsin India and Afghanistan• Some security vendors
explicitly says that thegroup is Pakistani

The whole picture of attribution
Due diligence defined ininternational laws
Attributions tostates

Less

Identifiable through technical analysis

Criminal
prosecution

Technical factors

Identifying
actorsIdentifying
attack group

Regional
background of
attack groups

Identifying attack
activities andmethods

More
Virtual identification

Narrowing down to a specific individual or organization

Time required for analysis
Time required for procedure2© 2023 JPCERT/CC

Is that actor really a ransomware gang?
Although RaaS, affiliate schemes, and the involvement of Russian and Eastern European criminals have received more attention,
there have actually been a number of ransomware attacks by a single unidentified attack group or APT group (or groups that
conducted APT campaigns in the past).
Not all actors are operating as a part of RaaS, even in cases where well-known ransomware is identified from builder leaks, etc.
However, in many cases, recovery is the priority in ransomware attack incident response, and thus analysis is not fully conducteduntil the cause of the attack, the ransomware used, and the attacker are identified.
In addition, there is a tendency that accurate analysis is not conducted due to first responders' lack of incident experience andinsufficient knowledge of ransomware attack response.

Affiliate scheme

Affiliate3© 2023 JPCERT/CC

A single
attack groupaffiliate(ex-) APT group

Case 1: Robinhood Leaks
Active since at least October 2021.
It was unclear whether the actor was Raas or a single attack group, butaround the same time, another attack by the same group using a different
ransomware (brand) was confirmed. It was believed that the same group
was doing a fake “rebranding.”
The group has targeted a wide range of companies in the past, including
a European P&C insurance company, an African marketing firm, aChinese manufacturer, and a U.S. software developer.
Uses a variant of Thanos ransomware (possibly using Thanos Builder)
File extensions after encryption appear to be abbreviated names of theaffected organizations (different extensions are used for each victim)
The X account was suspended in January 2022. Since then, the grouphas been using a Gettr account. Other SNS have also been used in thepast. In some cases, they direct people to Tox chat.
In the past, they have leaked some of the stolen data on SNS, but they
stopped doing so.
They are likely to exploit vulnerabilities in SSL-VPN products (orpreviously leaked credentials) in penetration4© 2023 JPCERT/CC

Identification by the characteristics of samples
There were multiple samples with the same characteristics on VirusTotal.
The target organization and region were inferred from the file extension after encryption, which is theabbreviated name of the target organization

https://twitter.com/GrujaRS/status/1484148716479172608
5© 2023 JPCERT/CC

https://any.run/report/f9533288e6a7279195902c8691d5f223c77015fa332b56e
23aeec3581c0cdbdb/ba082576-c0a4-4f18-9966-4b5e6da6108f

Ransomware actor that uses Thanos builder
Since October 2021?
The beginning of 2020

RobinhoodLeaks
Thaos builder
Sold on forum

Around July 2020

Since September 2021
不明グループGroup targeting Middle East and North Africa

Spook

Since February 2021
Since July 2021
Prometheus

Re-branding?
Haron6© 2023 JPCERT/CC

Shares characteristics
with Prometheus andThanosIdentification by negotiation methods and used media
Two Tox IDs found in the terminal side ransom note
— BC6934E2991～— 671263E7BC0～

Some vendors have labeled the sample that displays a ransom note with the same Tox ID as“JS Ransomware.” However, it appears to be the Thanos variant used by RobinhoodLeaks.

7© 2023 JPCERT/CC

Identification through attack infrastructure
37.143.131[.]224*Confirmed in the spook
ransomware case as well.

2021/5/16～2022/2/10

Validity 2022/2/9
2021/8/4～2022/2/10

2022/2/10～

178.209.51[.]243

Validity 2021/5/14
2022/2/10～

2022/2/10～
2021/8/4～2022/2/10

145.239.120[.]59

Validity 2020/3/30

2020/8/27～2020/12/18
2021/8/26～

2020/3/31～2021/1/24

Validity 2020/8/26

45.91.92[.]140
2020/8/27～2020/12/16

8© 2023 JPCERT/CC

Common characteristics among the cases
SSL-VPN Product

Spook ransom case

Case #1

Case #2

Case #3

Fortigate• Not listed on the Nov.
2020 Fortifuck list
• OS version remains
vulnerableSonicwall• Vulnerable version
used• Notified by
JPCERT/CC via DC in2021

Sonicwall• Vulnerable version
used• Notified by
JPCERT/CC via ISP
in 2021

Fortigate• Listed on the Nov.
2020 Fortifuck list
• Multiple other suspect
infrastructures

Unauthorized accessto SSL-VPN

From the same IP address

File extension.spook9Abbreviated name of the target organization

Contact information on
the ransom note (device)

Tox IDNot confirmed

Not confirmed

Contact information onthe ransom note (server)

NoneX accountGettr accountX account
Gettr account© 2023 JPCERT/CC

Case 2: Attack group that uses HUI loader
HUI Loader was identified in an incident response to an
targeted ransomware attack.

Originally used by various targeted cyber attack groups

Analysis of HUI Loader - JPCERT/CC Eyes
https://blogs.jpcert.or.jp/en/2022/05/HUILoader.html

10© 2023 JPCERT/CC—

APT10 (Since 2015)—

Blue Termite (Since 2015)—

A41APT (Since 2020)—

DEV-0401 (Since 2021)

Features of HUI Loader
Used mainly in targeted cyber attacks since around 2015
Samples contain a distinctive string

https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_
9_yanagishita-tamada-nakatsuru-ishimaru_en.pdf

11© 2023 JPCERT/CCDEV-0401
All confirmed attacks since 2021 that used Lockfile, AtomSilo, Rook, NightSky, or Pandora ransomware are suspected to be
performed by the same attack group, which Microsoft calls “DEV-0401.” Microsoft, SecureWorks, and others make the same
argument.
According to Microsoft, Lockbit2.0 has been used as ransomware payloads since April. Sygnia says Cheercrypt is also a fakerebrand of DEV-0401. Secureworks pointed out its connection to APT10.
Exploits ProxyShell, Confluence vulnerability (CVE-2021-26084), Log4j vulnerability in VMwareHorizon, and ManageEngine
ADSelfService Plus vulnerability (CVE-2021-40539) for initial penetration instead of compromising via SSL-VPN.
No case of compromise via SSL-VPN was confirmed by JPCERT/CC.

Microsoft
https://www.Microsoft.com/en-us/security/blog/2022/05/09/ransomwareas-a-service-understanding-the-cybercrime-gig-economy-and-how-toprotect-yourself/

12© 2023 JPCERT/CCSecureworks
https://www.secureworks.com/research/bronze-starlightransomware-operations-use-hui-loader

SYGNIA
https://blog.sygnia.co/revealing-emperor-dragonfly-a-chineseransomware-groupTracking DEV-0401 that uses HUI Loader
Lockile, Atom Silo, and Rook are similar to Babuk, whose source code leaked in September 2021.
NightSky is similar to Rook, and the packer is also identical.
Pandora and Rook contain the same code partially, and the packer is same as that of Nightsky‘s.
TTP between each ransom case is also similar.
LockFile

AtomSilo

ActiveSince Aug. 2021Since Sep. 2021

Initial Penetration

Proxyshell
vulnerability

Confluencevulnerability (CVE2021-26084)

DLL side loading

Used KuGou Active
Desktop legitimate file

Used KuGou Active
Desktop legitimate file

HUI Loader✓✓

Ransomware used

Ransomware sample

Nightsky

PandoraThe case
SecureWorks
responded

Since Nov. 2021

Since Dec. 2021

Since Feb. 2022

During Feb. 2022

ManageEngine
ADSelfService Plus
vulnerability (CVE2021-40539) was
possibly exploited.

VMWare Horizon
Log4j vulnerability

Rook✓

Used MacAfee
product legitimate file

Used MacAfee
product legitimate file✓✓

Similar

Similar
SimilarC2 infrastructure13© 2023 JPCERT/CC

Similar to NightSly
caseManageEngine
ADSelfService Plus
vulnerability (CVE2021-40539)

Similar to Atomsilocase✓Cases where incident response fails due to insufficient actor identification #1
As international tensions increase, people’s speculations associate attacks and actors with specific regions, or
relate the motivation for the attacks and the reasons for being targeted to international affairs and supply chain
relationships.
In reality, the attacks were conducted by actors completely unrelated to any particular region or supply chain,using known ransomware. They had been active since before the international situation changed. In some cases,
the ransomware types were even misidentified, linking it to an unrelated attack group.
Countermeasures are insufficient!
Large company’s business partners
are targeted!

Attack group X in State XX has been active!

Disclosure of incident

Attack group X

Largecompany

Business partners

Actors not related to a specific region

Misidentification

Totally unrelated
victim organizations

Attack Group Y14© 2023 JPCERT/CC

They may be the attack
group X's ransomware…?

Investigation vendor cannot identify it.

Cases where incident response fails due to insufficient actor identification #2
We identified communications due to a certain type of malware infection and contacted the organization, and it
turned out that it was due to the malware left unremoved in the ransomware attack over a year ago.
The forensic vendor at the time had failed to identify the attack group. The vulnerable Web server, which was theinitial access route used by the attack group at the time, was not investigated, and preventive measures were notproperly implemented.
Malware left unremoved

Attack Group?

SSL-VPN device

Forensic vendor cannot
identify it.
Vulnerability in Web server Y

Maybe penetrated through avulnerable SSL-VPN device?

Multiple security professionalorganizations trace attack group Y

Attack group X

15© 2023 JPCERT/CC

Why should ransomware attack actors be identified?
To ensure that initial response is appropriate, prompt, and at low cost
— Identify the cause of Initial Access.
— Reduce unnecessary network shutdowns and forensics in theinitial response by narrowing down the possible attack methods
used.
To ensure that APT actors conducting ransomware attacks are not missed.
To contain the ransomware threat and select effective countermeasures foreach actor.

16© 2023 JPCERT/CC

Ensuring fast and efficient initial response
Identify and narrow down the ransomware type and actor to infer the TTPs used
— Narrow down the initial access and lateral movement routes and determining the priorities ofinvestigation— Reduce unnecessary network and system shutdowns as much as possible...but in reality, the staffs are asked to investigate "all systems" and "whether any information has leaked."
From where didthey penetrate?

17© 2023 JPCERT/CC

To what extent havethey compromised?

Whether or not toshut down thenetwork and othersystems?

From where didthey penetrate?

To what extent havethey compromised?

Whether or not toshut down thenetwork and othersystems?

Why is the investigation of personal information leaks often prioritized?
Victim organizations often get overwhelmed by the “prompt” reports and notifications to affectedindividuals, which is required by the Personal Information Protection Law, and the resource forincident response is often sacrificed.
“Prompt” report required by PI Protection law

PI Protection
Commission

Personal Information

Detectionof Malware

Truly necessary actions
for response to APT attacks.

Information the attackers
were targeting18© 2023 JPCERT/CC

Notification and disclosure of the incident

Expected
disclosures as
response toAPT attacks

For a rational decision to refuse to pay ransom
Trend toward restricting ransom payments in various countries, including statements made at the Counter
Ransomware Initiative meeting lead by the U.S.
Depending on the actor, ransom payment can be considered sanction violation.
However, simply saying, “Do not pay ransom,“ does not provide a reasonable basis for decision making.
Efficient initial response minimizes additional “damage“ as much as possible.
Reputation
damageData loss/leak
Opportunity loss
Restoration costs
Investigation costs

Do not pay19© 2023 JPCERT/CCransom

Data loss/leak
Opportunity loss
Restoration costs
Investigation costs

MinimizeSanction
violation
ransom

Do not pay

To trace and counter APT actors
We may be missing APT attacks blended in numerous Lockbit 2.0 infection cases.
Subgroup of Lazarus

https://media.defense.gov/2023/Feb/09/2003159161/-1/1/0/CSA_RANSOMWARE_ATTACKS_ON_CI_FUND_DPRK_ACTIVITIES.PDF

20© 2023 JPCERT/CC

DEV-0401

https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-serviceunderstanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/

Lazarus subgroups self-finance their activities
APT43 (newly classified and tracked by Mandiant) is
considered to be conducting attack campaigns
targeting crypto assets for the purpose of self-funding
its activities.
Andariel, which includes Stonefly and several othersubgroups, uses Maui, Lockbit 2.0, and other types ofmalware, according to a February 2023 joint advisoryfrom U.S. officials. This is also considered to beintended for self-financing of its activities

https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023

21© 2023 JPCERT/CC

Dangerous
Password, etc.

APT43

Andariel

Intendedattacks targeting
crypto assets

Intended cyberattackIntended cyberattackAttacks targeting
crypto assets
for Self-financeRansomware
attacks for SelffinanceCase: countermeasures against affiliate scheme actors
In some cases, affiliate schemes disappeared due to internal conflicts, and in other cases, theactivities were ceased by the arrest of those involved.

Sometimes gangs spontaneously disappear
due to internal conflicts

Not all affiliates are skillful, and they can beinvestigated and arrested due to (Ex-)APT
Opsec group
単独の攻撃グループ
mistakes, etc.

Affiliate scheme

Affiliate22© 2023 JPCERT/CC

Affiliate

If the return is not economically worth, they will
be removed from the scope of the attack.
This means, if almost everyone in a certain
region or industry refuses to pay ransom, they
may not be targeted anymoreCase: countermeasures against a single attack group
Hypothesis: Attackers use fake rebranding because they may not like attribution for some reason.
— Exposing attack methods through alerts and analysis reports may deter attackers’ activities to some degree, even when
they are not arrested.
The scale of their activities is relatively small compared to affiliate schemes. Therefore, reducing the success rate andefficiency of their attacks to some degree, through alerts and other means, can be critical to their activities.

They may not like Attribution.

Affiliate Scheme

The scale of their activities is relatively small,and thus reducing the successrate and
オペレータ
オペレータ
efficiency of their attacks to some degree, byexposing the attack methods through alerts
and other means, can be critical to theiractivities.

23© 2023 JPCERT/CC

A single attackgroup(Ex-)APT group

Case: Countermeasures against APT Group
Since many APT actors have ceased or changed their activities due to public attribution or have changed theiractivities and techniques as a result of alerts and analytical reports in the past, similar countermeasures anddeterrence may be effective.
Since ransomware attacks are only a "side business" to them, they may temporarily or permanently withdraw fromransomware attacks after experiencing some continued failures

They may not like Attribution.

Affiliate Scheme

Affiliate24© 2023 JPCERT/CC

A single attack
group
オペレータ
Since ransomware attacks are not their top
priority, they may (temporarily) withdraw fromit after experiencing some failures.

(Ex-)APT group

Summary: Why ransomware attack group should be identified
To ensure that initial response is appropriate, prompt, and at low cost
To ensure that APT actors conducting ransomware attacks are not missed
To contain the ransomware threat and select effective countermeasures foreach actor.
⇒ Victims will be less inclined to pay ransom if the burden on them during
ransomware attack incident response can be reduced.

⇒ Appropriate countermeasures for each type of actors would reduce thenumber of ransom-actor involved ?

25© 2023 JPCERT/CC